112 matches found
security flaw
pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...
CVE-2005-2377
nssldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service crond and...
CVE-2005-2377
CVE-2005-2377 concerns nss_ldap, where versions 181 through 212 (before 213) used in Mandrake Corporate Server, Mandrake 10.0, and other OSes fail to handle a SIGPIPE when issuing an LDAP search. This can allow a remote attacker to cause a denial of service by making the LDAP server unavailable, ...
CVE-2005-2377
nssldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service crond and...
CVE-2005-2377
nssldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service crond and...
CVE-2005-2377
Removed by vendor...
Mandrake Linux Security Advisory : nss_ldap (MDKSA-2005:121)
Rob Holland, of the Gentoo Security Audit Team, discovered that pamldap and nssldap would not use TLS for referred connections if they are referred to a master after connecting to a slave, regardless of the 'ssl starttls' setting in ldap.conf. As well, a bug in nssldap in Corporate Server and...
pam_ldap and nss_ldap: Plain text authentication leak
Background pamldap is a Pluggable Authentication Module which allows authentication against an LDAP directory. nssldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP. TLS is Transport Layer Security, a protocol that allows...
OpenLdap pam_ldap / nss_ldap weak password change encryption
TLS is not used with LDAP server during password change, password is transmitted in cleartext...
GLSA-200507-13 : pam_ldap and nss_ldap: Plain text authentication leak
The remote host is affected by the vulnerability described in GLSA-200507-13 pamldap and nssldap: Plain text authentication leak Rob Holland of the Gentoo Security Audit Team discovered that pamldap and nssldap fail to use TLS for referred connections if they are referred to a master after...
pam_ldap/nss_ldap password leak in a master+slave+start_tls LDAP setup
pamldap/nssldap fail to re-start TLS when following referred connections. This can result in credentials being sent in clear text when pamldap/nssldap attempt to rebind. This affects any LDAP infrastructure which can generate referrals during NSS or PAM operations generally a master+slave LDAP...
CVE-2005-2069
pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...
CVE-2005-2069
pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...
CVE-2005-2069
The CVE concerns pam_ldap/nss_ldap used with OpenLDAP when the client is referred from a TLS-secured slave to a master; the following connection may not use TLS, allowing passwords to be sniffed. Connected advisories (e.g., Debian DSA-785-1) reference CVE-2005-2069 (and related CVEs) and note upd...
CVE-2005-2069
Removed by vendor...
CVE-2003-1055
The CVE-2003-1055 issue affects Sun Solaris 8 and 9 via the nss_ldap.so.1 library. The vulnerability is a buffer overflow caused by a long hostname used in an LDAP lookup, which can allow local users to gain root access. The connected records corroborate Solaris versions and the nss_ldap.so.1 com...
Mandrake Linux Security Advisory : nss_ldap (MDKSA-2002:075)
A buffer overflow vulnerability exists in nssldap versions prior to 198. When nssldap is configured without a value for the 'host' keyword, it attempts to configure itself using SRV records stored in DNS. nssldap does not check that the data returned by the DNS query will fit into an internal...
Solaris 9 (x86) : 114328-09
SunOS 5.9x86: nssldap.so.1 Patch. Date this patch was last updated by Sun : Nov/12/07 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...
RHEL 2.1 : nss_ldap (RHSA-2002:180)
Updated nssldap packages are now available for Red Hat Linux Advanced Server 2.1. These updates fix a potential buffer overflow which can occur when nssldap is set to configure itself using information stored in DNS as well as a format string bug in logging functions used in pamldap. Updated 09 J...